Document xorg-server use after free CVE.

Reviewed by:	zeising@

3 files changed, 89 insertions, 4 deletions

diff --git a/x11-servers/xorg-server/Makefile b/x11-servers/xorg-server/Makefile
index 635e7d873779..7c2c6a4177db 100644
--- a/x11-servers/xorg-server/Makefile
+++ b/x11-servers/xorg-server/Makefile
@@ -35,20 +35,22 @@ OPTIONS_EXCLUDE_sparc64=	HAL
 
 .if defined(WITH_NEW_XORG)
 XORG_VERSION=	1.12.4
-XORG_REVISION=	3
+XORG_REVISION=	4
 PLIST_SUB+=	OLD="@comment " NEW=""
 EXTRA_PATCHES+=	${FILESDIR}/extra-clang \
-		${FILESDIR}/extra-configure
+		${FILESDIR}/extra-configure \
+		${FILESDIR}/extra-new-dix_dixfonts.c
 .else
 XORG_VERSION=	1.7.7
-XORG_REVISION=	10
+XORG_REVISION=	11
 PLIST_SUB+=	OLD="" NEW="@comment "
 EXTRA_PATCHES+=	${FILESDIR}/extra-Xext-xace.c \
 		${FILESDIR}/extra-Xserver-os-xprintf.c \
 		${FILESDIR}/extra-include_eventstr.h \
 		${FILESDIR}/extra-os-utils.c \
 		${FILESDIR}/extra-dix_events.c \
-		${FILESDIR}/extra-Xserver-hw-xfree86-common-xf86Config.c
+		${FILESDIR}/extra-Xserver-hw-xfree86-common-xf86Config.c \
+		${FILESDPR}/extra-old-dix_dixfonts.c
 .endif
 
 USE_BZIP2=	yes
diff --git a/x11-servers/xorg-server/files/extra-new-dix_dixfonts.c b/x11-servers/xorg-server/files/extra-new-dix_dixfonts.c
new file mode 100644
index 000000000000..d1f56741f902
--- /dev/null
+++ b/x11-servers/xorg-server/files/extra-new-dix_dixfonts.c
@@ -0,0 +1,41 @@
+--- dix/dixfonts.c.orig	2012-05-17 19:09:01.000000000 +0200
++++ dix/dixfonts.c	2013-10-09 10:49:38.158284440 +0200
+@@ -1414,6 +1414,7 @@
+             GC *pGC;
+             unsigned char *data;
+             ITclosurePtr new_closure;
++            ITclosurePtr old_closure;
+ 
+             /* We're putting the client to sleep.  We need to
+                save some state.  Similar problem to that handled
+@@ -1425,12 +1426,14 @@
+                 err = BadAlloc;
+                 goto bail;
+             }
++            old_closure = c;
+             *new_closure = *c;
+             c = new_closure;
+ 
+             data = malloc(c->nChars * itemSize);
+             if (!data) {
+                 free(c);
++                c = old_closure;
+                 err = BadAlloc;
+                 goto bail;
+             }
+@@ -1441,6 +1444,7 @@
+             if (!pGC) {
+                 free(c->data);
+                 free(c);
++                c = old_closure;
+                 err = BadAlloc;
+                 goto bail;
+             }
+@@ -1453,6 +1457,7 @@
+                 FreeScratchGC(pGC);
+                 free(c->data);
+                 free(c);
++                c = old_closure;
+                 err = BadAlloc;
+                 goto bail;
+             }
diff --git a/x11-servers/xorg-server/files/extra-old-dix_dixfonts.c b/x11-servers/xorg-server/files/extra-old-dix_dixfonts.c
new file mode 100644
index 000000000000..163a4efe396c
--- /dev/null
+++ b/x11-servers/xorg-server/files/extra-old-dix_dixfonts.c
@@ -0,0 +1,42 @@
+--- dix/dixfonts.c.orig	2010-05-04 02:47:57.000000000 +0200
++++ dix/dixfonts.c	2013-10-09 10:54:40.488267646 +0200
+@@ -1508,6 +1508,7 @@
+ 	    GC *pGC;
+ 	    unsigned char *data;
+ 	    ITclosurePtr new_closure;
++	    ITclosurePtr old_closure;
+ 
+ 	    /* We're putting the client to sleep.  We need to
+ 	       save some state.  Similar problem to that handled
+@@ -1520,6 +1521,7 @@
+ 		err = BadAlloc;
+ 		goto bail;
+ 	    }
++	    old_closure = c;
+ 	    *new_closure = *c;
+ 	    c = new_closure;
+ 
+@@ -1527,6 +1529,7 @@
+ 	    if (!data)
+ 	    {
+ 		xfree(c);
++		c = old_closure;
+ 		err = BadAlloc;
+ 		goto bail;
+ 	    }
+@@ -1538,6 +1541,7 @@
+ 	    {
+ 		xfree(c->data);
+ 		xfree(c);
++		c = old_closure;
+ 		err = BadAlloc;
+ 		goto bail;
+ 	    }
+@@ -1551,6 +1555,7 @@
+ 		FreeScratchGC(pGC);
+ 		xfree(c->data);
+ 		xfree(c);
++		c = old_closure;
+ 		err = BadAlloc;
+ 		goto bail;
+ 	    }